ShieldFont Uses Typeface to Poison AI Scrapes
ShieldFont, launched on July 28, encodes page text as substituted source words while rendering the writer's intended wording for browser readers. Its OpenType rules aim to raise the cost of unauthorized mass scraping, but the same transformation can alter search indexing, copy-paste and find-in-page behavior, and the project warns that protected blocks do not meet WCAG 2.2 requirements.
ShieldFont, an open-source web-font project created by Isaque Seneda and Gabriel Abrucio, was announced on July 28. It encodes a page's text into substituted words in HTML while displaying the writer's intended wording to readers in a browser. The project relies on OpenType glyph-substitution rules to render encoded source words as different visible words, according to ShieldFont's GitHub repository.
The result is a deliberate split between the browser's visual output and the document text available to systems that collect raw HTML. ShieldFont's documentation describes the intended use as poisoning unauthorized AI-training datasets: readers see the original prose, while a scraper that does not render the font receives substituted text.
How the encoding works
ShieldFont performs its word swaps during server-side rendering or a build process, according to Help Net Security. That distinction prevents the substitution dictionary and the original words from being delivered alongside the page source.
The project documentation states that replacements are selected from matching grammatical categories so the encoded text remains syntactically plausible. The Register reports that the creators use roughly 250 word pools that combine properties including part of speech, semantic category, number, verb inflection and adjective degree. The publication also reports that about one-quarter of words in a text segment are replaced.
The font then maps each substituted word back to the desired visible word through OpenType rules. This extends familiar font behavior, such as ligatures that render two characters as a combined glyph, from individual characters to words.
Friction is part of the trade-off
Help Net Security reports that search engines receive the same encoded bytes as AI crawlers, meaning indexed text can differ from what a visitor sees. It also reports that copying text produces the encoded form and that browser find-in-page cannot locate an on-screen phrase when the source text uses different words. ShieldFont's own documentation says protected blocks fail WCAG 2.2 success criterion 1.3.1 even when its optional accessibility layer is enabled.
Those constraints distinguish ShieldFont from access controls such as robots.txt directives or server-side bot blocking. It does not selectively identify an AI crawler at request time. Instead, the protection applies to any system that consumes the encoded page text without the font-rendering path.
The repository offers a React package, @shieldfont/react, as well as a build-step option, and lists version v0.3.2 with a default mapping named alpha. It is released under the AGPL-3.0 license.
For ML practitioners, the project illustrates a data-provenance issue rather than a conventional model-security vulnerability. Systems that train or retrieve from web text often treat rendered pages, raw HTML, extracted text and copied content as interchangeable representations. Tools built around comparable transformations can expose differences between those representations, making dataset validation, content normalization and source-quality checks more consequential.
Key Points
- 1ShieldFont encodes HTML with substituted words and uses OpenType rules to render intended prose, separating visual text from raw scraped text.
- 2The technique also changes search indexing, copied text and find-in-page behavior, and the project's accessibility documentation says protected blocks do not meet WCAG 2.2.
- 3Comparable web-text transformations make provenance and normalization important because rendered pages and raw HTML can yield materially different training inputs.
Scoring Rationale
ShieldFont offers a technically unusual, open-source mechanism for altering the text collected by non-rendering web scrapers. It is relevant to dataset provenance and web extraction pipelines, but its use involves material indexing, accessibility and usability trade-offs.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
